IRIS - Incident Response Investigation System

Getting Started

IRIS is divided into two main parts: IrisWeb and IrisModules. IrisWeb is the web application containing the core of IRIS (web interface, database management, etc), while IrisModules are extensions that allow third parties to process data via IRIS.

Running IRIS

To ease installation and upgrades, IRIS is shipped in Docker containers. It can be ready in a few minutes.

Configuration

IRIS has three configuration options: Azure Key Vault, Environment Variables, and Configuration Files. This is also the order of priority, if a setting is not set it will fall back on the next option.

Versioning

Starting from version 2.0.0, IRIS follows Semantic Versioning 2.0 guidelines. The code ready for production is always tagged with a version number.

Showcase

IRIS has a demo instance available.

Documentation

Comprehensive documentation is available at docs.dfir-iris.org.

API

The API reference is available in the documentation or documentation repository.

Help

Contact IRIS on Discord, email, Twitter, or Matrix for any question, issue, or idea!

Considerations

IRIS is still in its early stage and should not be exposed to the Internet. It is recommended to use a private dedicated and secured network.

License

The contents of this repository are available under LGPL3 license.

> Visit iris web Website <